error: Private keys must be instance of RSAPrivate(Crt)Key or have PKCS#8 encoding

[Fahad-Alsaidi]

I am using 1.6.3 on ubuntu 16.04 (kde neon edtion) with PKCS#11 configured. When I try to sign a pdf I get this error:

DEBUG Relaxing SSL security.
DEBUG Registering SunPKCS11 provider from configuration in conf/pkcs11.cfg
DEBUG SunPKCS11 provider registered with name SunPKCS11-JSignPdf
INFO  Checking input and output PDF paths.
INFO  Getting key alias
INFO  Used key alias: ******* ******
INFO  Loading private key
INFO  Getting certificate chain
INFO  Opening input PDF file: test.pdf
INFO  Creating output PDF file: ./test_signed.pdf
INFO  Creating signature
INFO  Setting certification level
INFO  Configuring visible signature
INFO  Use only layers recommend by Acrobat 6: true
INFO  Setting background image scale
INFO  Setting Layer 2 text (description)
INFO  Setting Layer 4 text (status)
INFO  Setting Render mode
INFO  Creating visible signature
INFO  Processing (it may take a while) ...
ERROR Problem occured
java.security.InvalidKeyException: Private keys must be instance of RSAPrivate(Crt)Key or have PKCS#8 encoding
        at sun.security.rsa.RSAKeyFactory.translatePrivateKey(RSAKeyFactory.java:288)
        at sun.security.rsa.RSAKeyFactory.engineTranslateKey(RSAKeyFactory.java:191)
        at sun.security.rsa.RSAKeyFactory.toRSAKey(RSAKeyFactory.java:111)
        at sun.security.rsa.RSASignature.engineInitSign(RSASignature.java:106)
        at sun.security.rsa.RSASignature.engineInitSign(RSASignature.java:99)
        at java.security.Signature$Delegate.init(Signature.java:1155)
        at java.security.Signature$Delegate.chooseProvider(Signature.java:1115)
        at java.security.Signature$Delegate.engineInitSign(Signature.java:1179)
        at java.security.Signature.initSign(Signature.java:530)
        at com.lowagie.text.pdf.PdfPKCS7.<init>(Unknown Source)
        at net.sf.jsignpdf.SignerLogic.signFile(SignerLogic.java:336)
        at net.sf.jsignpdf.Signer.signFiles(Signer.java:242)
        at net.sf.jsignpdf.Signer.main(Signer.java:137)
INFO  Finished: Creating of signature failed.
DEBUG Removing security provider with name SunPKCS11-JSignPdf

Is it a bug or it is me I miss something?

[kwart]

The new DSS engine (#422) derives the signature algorithm from the key (EncryptionAlgorithm.forKey) instead of assuming RSA, so EC keys should sign via -eng dss. If you can retest with your EC token on a 3.1.0 build and report back, that'd be great — keeping this open until confirmed.